Privacy Policy

1. Introduction

SAI Technology is committed to ensuring the security and privacy of client data. While we do not directly store or manage data, we implement best practices aligned with GDPR, the Ghana Data Protection Act, and soon SOC 2 to ensure our solutions meet regulatory and security requirements.

2. Scope

This policy applies to all software solutions, services, and internal operations at SAI Technology. It covers data handling, security measures, and compliance responsibilities.

3. Data Protection Principles

SAI Technology aligns with the following principles:

Lawfulness, fairness, and transparency – We ensure clients are informed about data usage in their solutions.
Data minimization – Only necessary data is processed.
Security and confidentiality – We enforce strict security controls to prevent unauthorized access.

4. Access Control & Authentication

All development environments require role-based access control (RBAC).
Strong authentication methods such as multi-factor authentication (MFA) are enforced where applicable.
Access is restricted to authorized personnel only.

5. Data Encryption & Protection

Data in transit is secured using TLS 1.2 or higher.
Sensitive data at rest must be AES-256 encrypted.
Secure coding practices (aligned with OWASP Top 10) are followed.

6. Logging & Monitoring

Security events are logged and monitored for potential breaches.
Audit logs are maintained and reviewed periodically.
Automated threat detection tools are implemented.

7. Software Development Security

Secure Software Development Lifecycle (SDLC) is enforced.
Regular code security reviews and automated vulnerability scanning are performed.
Dependencies are monitored for security vulnerabilities.

8. Data Processing & Retention

Data collected within applications we build is handled in accordance with client requirements and applicable laws. We provide guidance on data retention policies to clients. Secure deletion methods are implemented when necessary.

9. Incident Response & Reporting

Security incidents are investigated and reported within 72 hours, following GDPR and Ghana Data Protection Act guidelines. A documented Incident Response Plan is in place.

10. Compliance & Internal Audits

Internal security audits are conducted bi-annually.
Employees receive ongoing security training.
Third-party service providers are assessed for compliance.

11. Vendor & Third-Party Risk Management

All third-party services used in solutions are evaluated for security and compliance. Data-sharing agreements are established where applicable.

12. Conclusion

SAI Technology is dedicated to maintaining the highest security standards to protect client data and uphold compliance with international and local regulations. This policy is subject to periodic updates based on evolving security threats and regulatory changes.